Firewall module

dear
we are having firewall module in datacenter switch which is not in production i have a task to configure now there are total 80 server which are in difftrent zone
so plz help me how to connfigure using multi context & any documentation to refer and configure
thanks

Managing Security Contexts
http://www.cisco.com/en/US/docs/security/fwsm/fwsm31/configuration/guide/contxt_f.html
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide, 3.1
http://www.cisco.com/en/US/docs/security/fwsm/fwsm31/configuration/guide/fwsm_cfg.html
Regards,
Arul

Similar Messages

Ciscoworks Firewall Module Support

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin-top:0cm;
mso-para-margin-right:0cm;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0cm;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;
mso-fareast-language:EN-US;}
We are using Firewall Modules in our Cat6500(s) (WS-SVC-FWM with FWSM 4.0(4)) to provide centralized firewall services to our users. I have been asked if there is any support for these blades in Ciscoworks. I don’t think these types of blade services have been integrated into Ciscoworks yet. We have the same issue with our wireless blades (WiSM)
I’m mostly interested on the ability to backup context configurations from the Firewall blades.
LMS 3.2 with RME 4.3.1 among others.
Thanks for any information.
Jorge A Jiles

The answer is yes, RME 4.3.1 support configuration management with the WS-SVC-FWM
Please refer to this link for a complete list of supported devices and modules.
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/3.2/device_support/table/lms32sdt.html
However, there is a enhancement bug opened as well that I think you will be interested in based on
the ability to backup context configurations from the Firewall blades.
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsl65838
CSCsl65838 Bug Details
Multicontext Firewalls should have ALL contexts archived from admin
Symptom:For firewalls that support multiple contexts, RME does not archive all the context configs if just the admin context IP is in the seedfile.
Conditions:Firewalls that support multiple contexts.
Workaround:Manage each context configuration as an individual, separate device in RME.
Further Problem Description:This capability should be added to RME so that the customer is not required to have IP reachability to each context and individually put that context into RME.All the contexts can be accessed from the Admin context by changeto context system. Then either fetch the configs from the file system (dir) or changeto each context and get its config.

Cisco Firewall Module 6509

Hi there,
I'm encountering a problem uploading a file when passing through the firewall module using a .NET application. Without passing through the firewall module, it only takes about 3 seconds for a 1mb file, however when passing through the firewall module, it takes around 1 minute or more. What settings can be done to resolve this issue?
The file upload is done via a .NET 2.0 desktop application, and uploading to the server, which is running on IIS port 80.

Hi Bro
I don't think this is a FWSM issue, but then again you never know :-) There could be few possibilities,
a) Is there QOS / MFP configured in your FWSM context?
b) Is your FWSM overloaded e.g. CPU/Memory Utilization?
c) How big are these uploaded files (>100Mb)? This is because the FWSM backplane is 5.5Gbps.

Dual Cat6k with Firewall module scenario

Hi All,
Does anyone have design guides for Core Cat6k L2/L3 network with Firewall modules in two different chassis ?
Thanks,
Praful

Try:
http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a008048e64c.html
http://www.cisco.com/en/US/products/hw/switches/ps708/products_installation_and_configuration_guide_chapter09186a00801c589c.html

Firewall Module with HSRP switches

Hello ,
We have implemented HSRP configuration between the core switches for 20 VLANs, as the following:
HSRP Configuration for switch 1;
Interface Vlan4
Description âVLAN Descriptionâ
Ip address 192.168.8.2 255.255.255.0
Standby 5 ip 192.168.8.1
Standby 5 timer 5 15
Standby 5 preempt
HSRP Configuration for switch 2;
Interface Vlan4
Description âVLAN Descriptionâ
Ip address 192.168.8.3 255.255.255.0
Standby 5 ip 192.168.8.1
Standby 5 timer 5 15
Standby 5 priority 50
Standby 5 preempt
Now, Only on the active core switch we have inserted a firewall Module to protect VLANs communication to each other while we dont have firewall on the standby switch. Im planning to implement firewall only on one switch if the VLAN fail the traffic will be diverted on the second switch without firewalling.
Would you please assist me on Firewall configuration when i have HSRP running as per my config.
Regards,

The transparent firewall feature greatly simplifies deployment in the data center for protecting hosts. The transparent firewalls also fit into existing networks with no Layer 3 changes and transparently pass Layer 3 traffic from routers, allowing interoperability with IP services such as Hot Standby Router Protocol (HSRP), Virtual Router Redundancy Protocol (VRRP), Gateway Load Balancing Protocol (GLBP), Multicast, and non-IP traffic such as Internetwork Packet Exchange (IPX), Multiprotocol Label Switching (MPLS), and bridge protocol data units (BPDUs).

Firewall Module with Confiugured HSRP switches

Hello ,
We have implemented HSRP configuration between the core switches for 20 VLANs, as the following:
HSRP Configuration for switch 1;
Interface Vlan4
Description âVLAN Descriptionâ
Ip address 192.168.8.2 255.255.255.0
Standby 5 ip 192.168.8.1
Standby 5 timer 5 15
Standby 5 preempt
HSRP Configuration for switch 2;
Interface Vlan4
Description âVLAN Descriptionâ
Ip address 192.168.8.3 255.255.255.0
Standby 5 ip 192.168.8.1
Standby 5 timer 5 15
Standby 5 priority 50
Standby 5 preempt
Now, Only on the active core switch we have inserted a firewall Module to protect VLANs communication to each other while we dont have firewall on the standby switch. Im planning to implement firewall only on one switch if the VLAN fail the traffic will be diverted on the second switch without firewalling.
Would you please assist me on Firewall configuration when i have HSRP running as per my config.
Regards,

HSRP provides two servicesIP redundancy and a Virtual IP (VIP) address. Each HSRP group may provide either or both of these services. Cisco IOS firewall stateful failover uses the IP redundancy services from only one HSRP standby group. It can use the VIP address from one or more HSRP groups. Use the following task to configure HSRP on the outside and inside interfaces of the router.
http://cisco.com/en/US/products/ps6441/products_feature_guide09186a00806106ea.html#wp1149287

Assigning VLANs to the Firewall Services Module

I need add a new vlan group to our fwsm module. I have some doubts:
What command do i need for it?
     firewall vlan-group 5 100,101,102,103,104,105
     firewall switch 2 module 4 vlan-group 5
     firewall switch 1 module 4 vlan-group 5
     or
     firewall vlan-group 5 100,101,102,103,104,105
     firewall switch 2 module 4 vlan-group 1,2,3,4,5
     firewall switch 1 module 4 vlan-group 1,2,3,4,5
Will it be disruptive?
Thanks!

So, just to confirm, in this case to add/append a new vlan-goup to the firewall module I should use:
Switch# firewall switch <1-2> module 02 vlan-group 2
My main concern is if with the command It will replace the curent vlan-goup (4,5,6) or if it just append the new vlan-group.
Thanks in advance!

Anomaly Guard Module Configuration

I have an 1Gbps AGM and I am configuring Anomaly Guard Module. For testing purpose, I am trying to bypass/route the traffic through AGM, but I could not. The configuration is as mentioned below. I have captured the traffic using packet-dump and I could understand that traffic is forwarded to AGM, but not leaving AGM.
Can you please advice, what is missing in this configuration to enable all traffic to pass through AGM.
Configuration:
6509 Config:
firewall multiple-vlan-interfaces
firewall module 2 vlan-group 161
firewall vlan-group 161 2,10,62
anomaly-guard module 8 port 1 allowed-vlan 2
anomaly-guard module 8 port 2 allowed-vlan 61,62
anomaly-guard module 8 port 1 native-vlan 2
vlan 2-3,10-12,20,50-51,61-62
end
AGM Config:
diversion hijacking receive-via-ip 172.17.61.16
diversion hijacking receive-via-vlan 61
diversion injection 172.18.10.0 255.255.255.0 nexthop 172.17.66.1
interface eth1
ip address 172.18.2.11 255.255.255.0
mtu 1500
no shutdown
exit
interface giga2
mtu 1500
proxy 172.17.61.15
no shutdown
exit
interface giga2.61
ip address 172.17.61.16 255.255.255.0
mtu 1500
no shutdown
exit
interface giga2.62
ip address 172.17.66.15 255.255.255.0
mtu 1500
no shutdown
exit
ip route 192.168.100.0 255.255.255.0 172.17.61.1 giga2.61
ip route 172.18.10.0 255.255.255.0 172.17.66.1 giga2.62
default-gateway 172.17.61.1
zone CUSTOMER GUARD_DEFAULT
ip address 172.18.10.0 255.255.255.0
no bypass-filter *
bypass-filter 10 * * * no-fragments
bypass-filter 11 172.17.61.1 * * no-fragments
bypass-filter 12 192.168.100.1 * * no-fragments
end

The Guard module can operate at two different bandwidth performance levels: 1 Gigabit per second (Gbps) or 3 Gbps. The software image that you load on the Guard module determines the operating bandwidth by controlling the three physical interfaces between the module and the supervisor engine.

CSA 5.1, overlapping exceptions and the infamous Rootkit Lockdown Module

Just looking for opinions and observations from the field:
By default, the rule placed in the Rootkit Lockdown Module, has the following attributes:
- Priority Deny
- Acting as client or server
- Any TCP & UDP services
- Communicating with "@(remote)" host addresses
A similar rule (though not the same, I know this, please don't point this out) in the Personal Firewall rule module, has these attributes:
- Deny
- Acting as server
- Any TCP & UDP services
- Communicating with any addresses
There are a couple of other restrictive modules/rules that aren't disabled that when enabled would provide the same protection that the Rootkit Lockdown Module would provide. Any opinions or experiences that anyone would like to share on whether or not you've taken the Rootkit Lockdown Module out of test mode, added exceptions, possibly unattached other rule modules that were doing the same thing, etc.
As well, does anyone have any further definition on the "@remote" addresses variable? Please be specific if you post a reply.

I took the rootkit lockdown module out of test mode after making exceptions for the events that were triggering it and it seems to be working OK.
Since the rootkit is dynamic, I'm going to leave it on unless it causes problems or there are events I can't make exceptions for.
A have the Personal Firewall module enabled and I made a couple of exceptions for it since it is on all the time.
I don't want any host acting as a server at any time unless there is a valid reason.
I deploy all hosts in test mode until tuned.
We are pretty standardized as far as machine hardware and settings go since we use all one brand and disk images to deploy. That makes for less surprises.
HTH..
Tom

Module Failed SCP dnld

Hi, I have a WS-SVC-IDSM-2 which is showing as PwrDown looking at the show power there is more than enough but there is an error message "Module Failed SCP dnld" does any body know why this is showing? it is something to do with the rom version.
Regards MJ

Sounds like IDSM2 rom issue, or switch IOS that does not recognise it. Sometime this is also happened to Firewall module (FWSM).
Do a 'show hw-module all fpd' and/or 'sh module'. Check the IDSM2 power status at the end of the line. Is the Status 'PwrDown'?
Check the IDSM-2 and switch version compatibility matrix. Issue 'sh version' on the switch, and check the IDSM-2 version (session into IDSM-2).
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/idsm/idsm_2/13074_04.htm#wp333372
HTH. Pls rate all useful post(s)
AK

Manually configuring ASA modules vs discovering them

We're starting to deploy ASA now to replace some aging / end of life devices (PIX and IDS sensors). Once the network admins set up the required IDS module(s) etc. on the ASA, I can then configure each of them as reporting devices in MARS (I can also discover the individual settings on the IPS e.g. virtual sensors ). Basically looks just like an IPS v7 box.
Question: should I first set up the ASA itself in MARS, and then use the discover feature top-down for MARS to uncover the IPS, firewall modules etc. - as opposed to configuring each module individually as a reporting device in MARS? Aside from the add'l effort required, are there any distinct advantages or issues with one method vs the other? What are the gotcha's if we ignore the ASA (from MARS perspective) and treat all modules individually - i.e. MARS would have no knowlege of the ASA itself, and considers the modules to be all "stand alone" in that respect...?
hope that makes sense
thanks

Hello,
You could use either methods and both of them are absolutely fine. There are no specific gotchas if you add the modules individually just that it is a little more work and it is absolutely fine to have the modules configured individually on the MARS.
Hope this clarifies!!
Thanks,
--Sunil

Eq 8080 commands not being entered on FWSM module

Hi There,
I'm having an issue with some Firewalls in my network. I have several firewall modules (WS-SVC-FWM-1) in 6509s,
FWSM Firewall Version 2.3(3) <system>
FWSM Device Manager Version 4.1(3)
I'm trying to enter the following rules
access-list ACL-IN extended permit ip host X.X.X.0 X.X.X.0 255.255.255.0 eq 8080
access-list ACL-IN extended permit ip host X.X.X.1 X.X.X.0 255.255.255.0 eq 8080
access-list ACL-IN extended permit ip host X.X.X.2 X.X.X.0 255.255.255.0 eq 8080
access-list ACL-OUT extended permit ip X.X.X.0 255.255.255.0 host X.X.X.0 eq 8080
access-list ACL-OUT extended permit ip X.X.X.0 255.255.255.0 host X.X.X.1 eq 8080
access-list ACL-OUT extended permit ip X.X.X.0 255.255.255.0 host X.X.X.2 eq 8080
What happens is, these commands don't go into the configuration, and I don't get an error, but any rule after it also does not get copied into the config when I copy and paste a list of commands. All the commands before it go in no problem.
Does it not like eq 8080? Can I not do 'permit ip' with an eq command? Do I have to use 'permit tcp' to enter the command?
Thanks.

If you are going to specify a port you need to use the TCP or UDP protocol. You are specifying IP so you will get an error because of this.

Firewall Vlan group

Buenas noches. Tengo un Cisco Catalyst 6500 con un módulo Firewall el cual tiene la siguiente configuración en el Switche:
firewall module 4 vlan-group 10,20,30,40,50,60,70,80,90,100,140,190,200,300,310,350
firewall vlan-group 10 10
firewall vlan-group 20 20
firewall vlan-group 30 30
firewall vlan-group 40 40
firewall vlan-group 50 50
firewall vlan-group 60 60
firewall vlan-group 70 70
firewall vlan-group 80 80
firewall vlan-group 90 90
firewall vlan-group 100 100
firewall vlan-group 140 140
firewall vlan-group 190 190
firewall vlan-group 200 200
firewall vlan-group 350 350
Cuando quiero agregar una nueva VLAN para que sea controlada por el Firewall, me aparece el siguiente mensaje de error:
No more than 16 groups allowed for a module
Este Core me permite hasta 256 VLAN's pero en grupos de a 16 Vlan. La pregunta es cómo puedo cambiar esta configuración para poder asignas más VLAN hacia el FWSM? Y en caso de hacerlo, es garantizable que no se pierda ninguna configuración del FWSM al hacer este cambio?
Quedo muy agradecido a la(s) persona(s) que me pueda colaborar con esta inquietud.
Feliz noche y hasta luego.
Francisco Velasco
E-mail: [email protected]

Dear Team
We have a core switch in VSS with FWSM running with multiple contexts.
I need to create 5 new DMZ (interfaces) in FWSM server context
Currently my config shows like below, which includes three "firewall vlan-group" statements, each with a comma-separated list of vlan numbers:
firewall switch 1 module 4 vlan-group 1,2,3
firewall switch 2 module 4 vlan-group 1,2,3
firewall vlan-group 1 2,3,4
firewall vlan-group 2 5,6,7 (vlans for server context)
firewall vlan-group 3 8,9,10
My question is: when I add the 5 new vlans, do I have to simply issue an additional "firewall vlan-group" statement with the five new vlan numbers, like this?
firewall vlan-group 2 30,40,50,60,70 (I need to add vlans in vlan-group 2)
In other words, will above command overwrite my existing list of vlans in vlan group 2 if I only add the five new vlans in vlan group 2 ? I obviously don't want to lose connectivity by erasing all my existing vlans.
Or do I have to issue a new statement that includes ALL of the existing vlans and five new vlans, like this?
firewall vlan-group 2 [all previously existing vlans],30,40,50,60,70 (five new vlans)
I want to know if i typed the above command with existing vlan and the new vlans does it cause any issues to the running environment b/c i think with the above command existing vlans will also be pushed along with new vlans to FWSM again or this is not the case.

Wism Module Controller 2 not detect IP Address

Hi, im badrul..i got one problem regarding the wism module controller. as we know in wism module have 2 controller, controller 1 and controller 2. i try to configure that wism module. but only controller 1 can used. for controller 2, it not detect the IP address that assign by DHCP. i try direct console on console port 2 on wism module, but it not detect console also. so i need help from who expert on this matter to soft my problem.

Thanks Justin on your respond
here the commands :
sh module
Mod Ports Card Type                              Model              Serial No.
1   24 CEF720 24 port 1000mb SFP              WS-X6724-SFP       SAL1329U59V
3    6 Firewall Module                        WS-SVC-FWM-1       SAD1311014S
4    8 Intrusion Detection System             WS-SVC-IDSM-2      SAD124101TB
7    2 Supervisor Engine 720 (Active)         WS-SUP720-3B       SAL1326T4VZ
9   10 WiSM WLAN Service Module               WS-SVC-WISM-1-K9   SAD132500BX
10    8 CEF720 8 port 10GE with DFC            WS-X6708-10GE      SAL15108PHU
11    4 CEF720 4 port 10-Gigabit Ethernet      WS-X6704-10GE      SAL1329U9DC
12    4 CEF720 4 port 10-Gigabit Ethernet      WS-X6704-10GE      SAL1416FNEH
13    8 CEF720 8 port 10GE with DFC            WS-X6708-10GE      SAL1517CGRF
Mod MAC addresses                       Hw    Fw           Sw           Status
1 0026.0b5b.46b4 to 0026.0b5b.46cb   4.1   12.2(18r)S1 12.2(33)SXH5 Ok
3 0021.a082.b420 to 0021.a082.b427   4.5   7.2(1)       4.0(4)       Ok
4 0021.d869.d4e0 to 0021.d869.d4e7   6.4   7.2(1)       5.0(2)       Ok
7 0024.1499.51d8 to 0024.1499.51db   5.9   8.5(3)       12.2(33)SXH5 Ok
9 0024.9774.2344 to 0024.9774.2353   2.3   12.2(14r)S5 12.2(33)SXH5 Ok
10 c89c.1d2f.5a78 to c89c.1d2f.5a7f   2.3   12.2(18r)S1 12.2(33)SXH5 Ok
11 0026.0b5b.4694 to 0026.0b5b.4697   2.9   12.2(14r)S5 12.2(33)SXH5 Ok
12 8843.e11b.4eb0 to 8843.e11b.4eb3   3.1   12.2(14r)S5 12.2(33)SXH5 Ok
13 e05f.b974.e7d0 to e05f.b974.e7d7   2.3   12.2(18r)S1 12.2(33)SXH5 Ok
Mod Sub-Module                  Model              Serial       Hw     Status
1 Centralized Forwarding Card WS-F6700-CFC       SAL1329U27Q 4.1    Ok
4 IDS 2 accelerator board     WS-SVC-IDSUPG      CFBG8260009 2.5    Ok
7 Policy Feature Card 3       WS-F6K-PFC3B       SAL1326SS36 2.5    Ok
7 MSFC3 Daughterboard         WS-SUP720          SAL1326T1EZ 4.0    Ok
9 Centralized Forwarding Card WS-SVC-WISM-1-K9-D SAD1324048G 2.1    Ok
10 Distributed Forwarding Card WS-F6700-DFC3C     SAL1516C139 1.4    Ok
11 Centralized Forwarding Card WS-F6700-CFC       SAL1327TF1L 4.1    Ok
12 Centralized Forwarding Card WS-F6700-CFC       SAL1414EZAX 4.1    Ok
13 Distributed Forwarding Card WS-F6700-DFC3C     SAL1517CHK1 1.4    Ok
Mod Online Diag Status
1 Pass
3 Pass
4 Pass
7 Pass
9 Pass
10 Pass
11 Pass
12 Pass
13 Pass
show wism status
Service Vlan : 900, Service IP Subnet : 20.20.10.254/255.255.255.0
      WLAN
Slot Controller Service IP       Management IP    SW Version Status
----+-----------+----------------+----------------+-----------+---------------
9     1           20.20.10.1          172.28.40.11         5.2.178.0      Oper-Up
9     2           0.0.0.0                0.0.0.0                                     Service Port Up
show wism module 9 controller 1 status
WiSM Controller 1 in Slot 9 configured with auto-lag
Operational Status of the Controller : Oper-Up
Service VLAN                         : 900
Service Port                            : 9
Service Port Mac Address        : 0025.84a9.a062
Service IP Address                  : 20.20.10.1
Management IP Address          : 172.28.40.11
Software Version                      : 5.2.178.0
Port Channel Number               : 417
Allowed-vlan list                       : 8,15,19,31,40-41,44,50-51,200,208,212,800,900
Native VLAN ID                        : 900
WCP Keep Alive Missed           : 0
show wism module 9 controller 2 status
WiSM Controller 2 in Slot 9 configured with auto-lag
Operational Status of the Controller : Service Port Up
Service VLAN                          : 900
Service Port                             : 10
Service Port Mac Address         : 0025.84ba.08a2
Service IP Address                   : 0.0.0.0
Management IP Address           : 0.0.0.0
Software Version                       :
Port Channel Number                : 418
Allowed-vlan list                        : 8,15,19,31,40-41,50-51,200,208,212,800,900
Native VLAN ID                         : 900
WCP Keep Alive Missed            : 0
TQ again Justin...

Firewall "via" inserted incorrectly?

On my 10.6 server, I have two ethernet ports. EN1 is for external usage, EN2 for internal usage. I have a few ports enabled using the built-in “any” address group; the idea is that these would be available on either ethernet. I also have an address group for my own network's IP addresses set up to allow access to all ports. Recently, I discovered I could no longer access services using the internal ethernet's IP unless they were enabled in the “any” group. I examined the Active Rules table in SA, and found that each of the rules generated for my internal address group were of the form: “allow log ip from XXX to any via en2 keep-state”, where XXX is one of my network's IP addresses or subnets. What I'm wondering is why the “via en2” was inserted in that rule. I have another server running the same software and with a similar configuration; on that server this problem doesn't exist and there are no via's inserted in the corresponding rules. I believe the system with the problem would probably go back to working correctly if the via's were not there (allow log ip from XXX to any keep-state).
So, basically, how can you control the presence of the “via en?” modifier using SA's Firewall module? Or, is there some other reason why I am experiencing this behavior?
Greg Shenaut

Hi -
This forum is dedicated to Rights Management Services, which cannot help you with your current issue. I suggest reposting your question in the Windows Server forum:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?category=windowsserver
Thanks!
Micah LaNasa
Synergy Advisors
synergyadvisors.biz

Firewall module

Similar Messages

Maybe you are looking for